Can I create Sincedb file on daily basis?

Elastic Stack Logstash
1

Hi Experts,

I want to create sincedb file on daily basis from LS1.5.4 . Actually this will help me to re-index today's data only as I am creating index on daily basis. So my plan is to delete today's sincedb file and re-index the data. Hope i am clear with my point .For now my LS config file is like

input {   
          file { 
    		  type => "abc"
             path => "E:/CEF/latest/*"  
    	      start_position => "beginning" 
    		  sincedb_path => "E:/db/test" 
		  
 } 
}
filter{
.....
.....}
output {   
if [type] == "abc" {
		elasticsearch { 
		protocol => "http"
        action => "index" 
        host => "localhost" 
        index => "test-%{[@metadata][now]}" 
		workers => 3  
					}   
				}
}

So I want something like sincedb_path => "E:/db/test_currentdate"

2

Let me ask this way , lets say I have 3 log files in a folder which are created on different dates . Something like
abc_01-03-2016
bc_02-03-2016
cd_03-03-2016

Now with the above LS config files all will be parsed and data will be saved in a single current date index . Also sincedb holds the pointer to the last line of cd_03-03-2016 file . My requirement is to only re-index bc_02-03-2016 data . If i delete complete sincedb file it will reindex whole data from the beginning and that does not solve my purpose . The question would be how to reindex a single file from bunch of files?

3

Hi @vikas_gopal
I have same problem.
Did you figure out how to solve it ?

4

@yahoo No !! for now I am only opting reindexing . I know this is painful but I do not get any answer to my query .I am sure many folks will have same question and may be they achieved it . I am still waiting :frowning:

5

Can't you just start up another Logstash instance with a different sincedb path where the input just specifies the file you want to reindex, and not the whole directory?

6

@Christian_Dahlqvist,

Thanks for the response , this is exactly what I am doing to get reindex specific file data , things will be more easy for me if I have sincedb on daily basis.